UK Online Safety Act sparks 415% spike in VPN discussions on Reddit

A new paper from researchers at the University of Edinburgh, Newcastle University, and Durham University provides real-world evidence that online safety regulation can inadvertently increase privacy risks. The study focuses on the UK Online Safety Act (OSA), passed in October 2023, which enforces age-assurance and safety requirements on social media, search, and adult content platforms. By analyzing Reddit posts from VPN and UK Politics communities alongside Google search data, the researchers observed how user behavior changed after each of three enforcement milestones: Ofcom’s illegal content duties (March 2025), the initial age-verification deadline for adult content (July 2025), and subsequent phases. Reddit discussions explicitly about VPN use in a privacy or regulatory context rose by 100%, 217%, and 415%, respectively, among UK-based users. UK Politics communities showed even larger effects, with OSA-related political discourse increasing by 213%, 545%, and 464%. Google search interest in VPNs also rose 89% at the age-verification deadline.

These findings challenge the assumption that safety mandates operate without secondary costs. Rather than simply seeking access to blocked content, users framed their VPN adoption around privacy, surveillance concerns, and distrust of age-verification intermediaries. Importantly, the spike in demand was distributed across low, medium, and high-risk VPNs, with no disproportionate shift toward higher-risk providers. The researchers conclude that online safety regulation can create significant privacy costs even when it does not drive users to the most dangerous services. For policymakers and tech leaders, this underscores the need to design regulations that protect children without fueling a broader erosion of digital privacy.